What’s Vulnerable › Vulnerabilities

CVE-2025-0316: WP Directorybox Manager <= 2.5 - Authentication Bypass

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-02-08 · updated 2026-06-17
• Weakness: CWE-288

Description

The WP Directorybox Manager plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.5. This is due to incorrect authentication in the 'wp_dp_enquiry_agent_contact_form_submit_callback' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.

Affected products

• Chimpstudio WP Directorybox Manager: through 2.5

References

• https://themeforest.net/item/directory-multipurpose-wordpress-theme/10480929
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3ee1f412-7555-4dec-ba59-49412471a42f?source=cve

Get alerted when CVE-2025-0316 or the next vulnerability affects your stack